3 Commits

Include renames

Author	SHA1	Message	Date
clawbot	957de7f99f	Make the HSTS max-age configurable with HSTS_MAX_AGE (closes #271) ... HSTS_MAX_AGE, a Go duration, sets the max-age of the Strict-Transport-Security header. Unset, it is ten years (87600h); 0 sends no header at all. A negative value, or one that is not a whole number of seconds, stops startup like an unparseable one. includeSubDomains and preload stay in the header. The value is shown on /settings and in the startup log, and the README's HSTS section now says what each part of the header commits the operator to. Model: opus-5-5	2026-10-13 03:27:24 +02:00
clawbot	21aafbf928	Remove the no-op MAINTENANCE_MODE setting (closes #317) ... MAINTENANCE_MODE did nothing but make the healthcheck JSON report maintenanceMode: true; no request was ever served differently, so an operator who set it expecting requests to be refused got nothing. It is removed from the configuration, the startup configuration log line, the healthcheck JSON, the README and the Settings page, together with the uncalled Server.MaintenanceMode method and the healthcheck's dependency on the configuration. A leftover value in an environment is ignored like any other unknown variable. Model: opus-5-5	2026-10-02 13:27:43 +02:00
clawbot	287e47df7f	Add a read-only Settings page for the loaded configuration (closes #402) ... A new page at /settings, linked from the navigation bar and behind the login, lists every configuration field the server loaded at startup: its environment variable, the README table's description, and the value in effect. METRICS_PASSWORD and SENTRY_DSN show only as set or not set; their values are replaced before rendering and never reach the template. The route is GET only and its group is built like the other admin page groups. Tests set the credentials one at a time so each value shown is checked against its own field and a set secret never appears in the page. Model: opus-5-5	2026-10-02 12:30:21 +02:00